Homomorphic encryption has long been a subject of great interest in the field of cryptography due to its potential applications in cloud computing for outsourcing analysis and hosting of private data. Homomorphic encryption generally refers to encryption that allows functions to be performed on ciphertext to obtain an encrypted result. When decrypted, the result matches the result of the same functions performed on the plaintext. This allows a person to encrypt data and have functions (e.g., data mining operations) performed on the data by a third party, without that third party being able to perceive the data. Fully homomorphic encryption supports both addition and multiplication operations, and thus preserves the ring structure of the plaintext. Under this scheme, any circuit can be homomorphically evaluated, allowing the construction of programs that may be run on encryptions of their inputs to produce an encryption of their output. Since such a program never decrypts its input, the inputs and the internal state of the data is never exposed, and cannot be perceived by a third party.
The first fully homomorphic encryption scheme using lattice-based cryptography was shown by Craig Gentry of IBM in mid-2009. Gentry's method was based on the accumulation of an error vector, which is corrected for by ‘homomorphically’ decrypting the data and squashing the error. This method thus requires and introduces ciphertext expansion and error squashing operations. At present, deployment of the Gentry homomorphic encryption system is not practical because of the excessive time and processor resources required. For example, using non-homomorphic analysis on a 256-bit AES (Advanced Encryption Standard) block takes on the order of milliseconds using present computer systems, but upwards of 36 hours when performed using the Gentry homomorphic encryption method. This is clearly an unacceptable amount of time and processing overhead for most, if not all practical applications at present.
The subject matter discussed in the background section should not be assumed to be prior art merely as a result of its mention in the background section. Similarly, a problem mentioned in the background section or associated with the subject matter of the background section should not be assumed to have been previously recognized in the prior art. The subject matter in the background section merely represents different approaches, which in and of themselves may also be inventions.